69e5e95181bc68b944209d8583312068c33a6f9c8332bbc08325e8b6dda1b20a

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

694e45b61f01c93ab97b6bd9060a3b25_JaffaCakes118.exe
Size

499KB
MD5

694e45b61f01c93ab97b6bd9060a3b25
SHA1

1150846b2cd1166ad1515727e085a9a6b27649b7
SHA256

69e5e95181bc68b944209d8583312068c33a6f9c8332bbc08325e8b6dda1b20a
SHA512

9b6acfa2e790389d9c0cd298e6a0d060aadce020a9e41a5045c2d496393cce3139a366444ce6ffa2882d7d97b5b6e362b7f3d4e30c00b1574d32fa829361034e
SSDEEP

12288:Hm4CaTX3StnvL+hiCwQYWLfYWoqKohxCb4AccJ+s/2EiNnq:HoaTX4Cf7lRhxCb95wsezNnq

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	694e45b61f01c93ab97b6bd9060a3b25_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2724	560	694e45b61f01c93ab97b6bd9060a3b25_JaffaCakes118.exe	29
PID 560 wrote to memory of 2724	560	694e45b61f01c93ab97b6bd9060a3b25_JaffaCakes118.exe	29
PID 560 wrote to memory of 2724	560	694e45b61f01c93ab97b6bd9060a3b25_JaffaCakes118.exe	29
PID 560 wrote to memory of 2724	560	694e45b61f01c93ab97b6bd9060a3b25_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\694e45b61f01c93ab97b6bd9060a3b25_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\694e45b61f01c93ab97b6bd9060a3b25_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$203130531.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$203130531.bat

Filesize
184B

MD5
4259f92a29638d63f870e2978fc0c20e

SHA1
23602114f0cfc1df634608bcdce304b863e46266

SHA256
cb617a84a866ae26e05cae8e327d094015a61efa3c95a9b9b41b37deb89579d9

SHA512
f636d96ba70d8079d171d7195b04ba9b45a4e616d1953f111c2834c06748dc7cf8ec4bcc54c540c03594986df9b006f1cb1716cc8578d0fe743e788e9540b8ef

Download Submit
memory/560-0-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/560-8-0x0000000000400000-0x0000000000566000-memory.dmp

Filesize
1.4MB

Download